|  | 6.2 | ACL Configuration Tasks
| 6.2.1 | Creating ACLs

In practice, ACL commands can be lengthy character strings. Key tasks covered in this section for creating ACLs include the following: You create ACLs by using the global configuration mode. Specifying an ACL number from 1 to 99 instructs the router to accept standard ACL statements. Specifying an ACL number from 100 to 199 instructs the router to accept extended ACL statements. You must carefully select and logically order the ACL. Permitted IP protocols must be specified; all other protocols should be denied. You should select which IP protocols to check; any other protocols are not checked. Later in the procedure, you can also specify an optional destination port for more precision. Grouping ACLs to interfaces Although each protocol has its own set of specific tasks and rules that are required to provide traffic filtering, in general most protocols require the two basic steps. The first step is to create an ACL definition, and the second step is to apply the ACL to an interface. ACLs are assigned to one or more interfaces and can filter inbound traffic or outbound traffic, depending on the configuration. Outbound ACLs are generally more efficient than inbound, and are therefore preferred. A router with an inbound ACL must check every packet to see whether it matches the ACL condition before switching the packet to an outbound interface. Assigning a unique number to each ACL When configuring ACLs on a router, you must identify each ACL uniquely by assigning a number to the protocol's ACL. When you use a number to identify an ACL, the number must be within the specific range of numbers that is valid for the protocol. You can specify ACLs by numbers for the protocols listed in the table. The table also lists the range of ACL numbers that is valid for each protocol. After you create a numbered ACL, you must assign it to an interface for it to be used. If you want to alter an ACL containing numbered ACL statements, you need to delete all the statements in the numbered ACL by using the command no access-list list-number.
| Engineering Journal
| Numbered ACL Configuration Example